VDB
Sign up
HIGH7.5

GHSA-wm9w-rjj3-j356

Apache Tomcat - Denial of Service

Quick fix

GHSA-wm9w-rjj3-j356 — org.apache.tomcat.embed:tomcat-embed-core: upgrade to the fixed version with the command below.

# pom.xml: bump <version>11.0.0-M21</version> for org.apache.tomcat.embed:tomcat-embed-core

Details

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in: 11.0.0-M1Fixed in: 11.0.0-M21
Fix# pom.xml: bump <version>11.0.0-M21</version> for org.apache.tomcat.embed:tomcat-embed-core
Maven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in: 10.1.0-M1Fixed in: 10.1.25
Fix# pom.xml: bump <version>10.1.25</version> for org.apache.tomcat.embed:tomcat-embed-core
Maven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in: 9.0.0-M1Fixed in: 9.0.90
Fix# pom.xml: bump <version>9.0.90</version> for org.apache.tomcat.embed:tomcat-embed-core
Maven/org.apache.tomcat:tomcat-coyote
Introduced in: 11.0.0-M1Fixed in: 11.0.0-M21
Fix# pom.xml: bump <version>11.0.0-M21</version> for org.apache.tomcat:tomcat-coyote
Maven/org.apache.tomcat:tomcat-coyote
Introduced in: 10.1.0-M1Fixed in: 10.1.25
Fix# pom.xml: bump <version>10.1.25</version> for org.apache.tomcat:tomcat-coyote
Maven/org.apache.tomcat:tomcat-coyote
Introduced in: 9.0.0-M1Fixed in: 9.0.90
Fix# pom.xml: bump <version>9.0.90</version> for org.apache.tomcat:tomcat-coyote
Maven/org.apache.tomcat:tomcat-coyote
Introduced in: 8.5.0

No fixed version published yet for org.apache.tomcat:tomcat-coyote (maven). Pin to a known-safe version or switch to an alternative.

Maven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in: 8.5.0

No fixed version published yet for org.apache.tomcat.embed:tomcat-embed-core (maven). Pin to a known-safe version or switch to an alternative.

References